aboutsummaryrefslogtreecommitdiff
path: root/include/qapi/qmp
diff options
context:
space:
mode:
authorliujunjie <liujunjie23@huawei.com>2018-07-24 21:43:39 +0800
committerMarkus Armbruster <armbru@redhat.com>2018-07-28 09:09:58 +0200
commitad63c549ecd4af4a22a675a815edeb06b0e7bb6e (patch)
tree53071d44635706a7d6f59a9fecb0bac63d98d13e /include/qapi/qmp
parent18a398f6a39df4b08ff86ac0d38384193ca5f4cc (diff)
downloadqemu-ad63c549ecd4af4a22a675a815edeb06b0e7bb6e.zip
qemu-ad63c549ecd4af4a22a675a815edeb06b0e7bb6e.tar.gz
qemu-ad63c549ecd4af4a22a675a815edeb06b0e7bb6e.tar.bz2
qstring: Fix qstring_from_substr() not to provoke int overflow
qstring_from_substr() parameters @start and @end are of type int. blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(), and qstring_from_str() pass @end values of type size_t or ptrdiff_t. Values exceeding INT_MAX get truncated, with possibly disastrous results. Such huge substrings seem unlikely, but we found one in a core dump, where "info tlb" executed via QMP's human-monitor-command apparently produced 35 GiB of output. Fix by changing the parameters size_t. Signed-off-by: liujunjie <liujunjie23@huawei.com> Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'include/qapi/qmp')
-rw-r--r--include/qapi/qmp/qstring.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/include/qapi/qmp/qstring.h b/include/qapi/qmp/qstring.h
index b3b3d44..3e83e3a 100644
--- a/include/qapi/qmp/qstring.h
+++ b/include/qapi/qmp/qstring.h
@@ -24,7 +24,7 @@ struct QString {
QString *qstring_new(void);
QString *qstring_from_str(const char *str);
-QString *qstring_from_substr(const char *str, int start, int end);
+QString *qstring_from_substr(const char *str, size_t start, size_t end);
size_t qstring_get_length(const QString *qstring);
const char *qstring_get_str(const QString *qstring);
const char *qstring_get_try_str(const QString *qstring);